Firebase storage rules - logged-out user can open a doc if path is known

Question

I\'ve got a simple firebase storage rule checking that only a logged-in user can access a doc:

match /b/{bucket}/o {
    
 match /{allPaths=**} {
   allow wri